feat: route Sundial at /sundial alongside legacy web-terminal

Add the sundial container (ghcr.io/freeshardbase/sundial:0.1.0) to the
shard compose stack and route it at PathPrefix(/sundial) with priority 2
so it wins over web-terminal's PathPrefix(/) priority-1 catch-all. The
router chains redirect-sundial-slash (RedirectRegex forcing bare
/sundial to /sundial/) before strip-sundial (StripPrefix /sundial),
because the Sundial image serves at root and derives its base path
client-side from the browser URL: stripping lets the root-serving image
work behind /sundial, and the trailing-slash redirect makes base
detection resolve to /sundial/ instead of / (which would break asset
links and fall through to web-terminal). Like web-terminal, the route is
unauthenticated: Sundial is a public UI shell that itself calls the
authed /core/protected API.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: ClaydeCode

docker-compose.yml

@@ -75,3 +75,10 @@ services:
     restart: always
     networks:
       - portal
+
+  sundial:
+    image: ghcr.io/freeshardbase/sundial:0.1.0
+    container_name: sundial
+    restart: always
+    networks:
+      - portal

shard_core/service/traefik_dynamic_config.py

@@ -69,6 +69,14 @@ def _add_http_section(model: t.Model, portal: SafeIdentity):
             service="web-terminal",
             tls=make_http_cert_resolver(portal),
         ),
+        "sundial": t.HttpRouter(
+            rule="PathPrefix(`/sundial`)",
+            priority=2,
+            entryPoints=[http_entrypoint],
+            service="sundial",
+            middlewares=["redirect-sundial-slash", "strip-sundial"],
+            tls=make_http_cert_resolver(portal),
+        ),
         "traefik": t.HttpRouter(
             rule=f"HostRegexp(`traefik.{portal.domain}`)",
             entryPoints=[http_entrypoint],
@@ -84,6 +92,20 @@ def _add_http_section(model: t.Model, portal: SafeIdentity):
                 stripPrefix=t.StripPrefixMiddleware(prefixes=["/core/"])
             )
         ),
+        "strip-sundial": t.HttpMiddleware(
+            root=t.HttpMiddlewareItem21(
+                stripPrefix=t.StripPrefixMiddleware(prefixes=["/sundial"])
+            )
+        ),
+        "redirect-sundial-slash": t.HttpMiddleware(
+            root=t.HttpMiddlewareItem16(
+                redirectRegex=t.RedirectRegexMiddleware(
+                    regex="^(https?://[^/]+)/sundial$",
+                    replacement="${1}/sundial/",
+                    permanent=True,
+                )
+            )
+        ),
         "auth-private": t.HttpMiddleware(
             root=t.HttpMiddlewareItem9(
                 forwardAuth=t.ForwardAuthMiddleware(
@@ -147,6 +169,13 @@ def _add_http_section(model: t.Model, portal: SafeIdentity):
                 )
             )
         ),
+        "sundial": t.HttpService(
+            root=t.HttpServiceItem(
+                loadBalancer=t.HttpLoadBalancerService(
+                    servers=[t.Server(url="http://sundial:80/")]
+                )
+            )
+        ),
     }
     model.http = t.Http(routers=_routers, middlewares=_middlewares, services=_services)
 

tests/test_traefik_dyn_spec.py

@@ -23,20 +23,34 @@ async def test_template_is_written(api_client):
             "app-error",
             "auth",
             "strip",
+            "strip-sundial",
+            "redirect-sundial-slash",
             "auth-public",
             "auth-private",
             "auth-management",
         }
         assert "authResponseHeadersRegex" in out_middlewares["auth"]["forwardAuth"]
+        assert out_middlewares["strip-sundial"]["stripPrefix"]["prefixes"] == [
+            "/sundial"
+        ]
+        assert out_middlewares["redirect-sundial-slash"]["redirectRegex"] == {
+            "regex": "^(https?://[^/]+)/sundial$",
+            "replacement": "${1}/sundial/",
+            "permanent": True,
+        }
 
         out_services_http: dict = output["http"]["services"]
         assert set(out_services_http.keys()) == {
             "shard_core",
             "web-terminal",
+            "sundial",
             "filebrowser_http",
             "paperless-ngx_http",
             "immich_http",
         }
+        assert out_services_http["sundial"]["loadBalancer"]["servers"] == [
+            {"url": "http://sundial:80/"}
+        ]
         assert out_services_http["filebrowser_http"]["loadBalancer"]["servers"] == [
             {"url": "http://filebrowser:80"}
         ]
@@ -47,13 +61,24 @@ async def test_template_is_written(api_client):
             "shard_core_public",
             "shard_core_management",
             "web-terminal",
+            "sundial",
             "traefik",
             "filebrowser_http",
             "paperless-ngx_http",
             "immich_http",
         }
         assert out_routers_http["filebrowser_http"]["service"] == "filebrowser_http"
 
+        sundial_router = out_routers_http["sundial"]
+        assert sundial_router["rule"] == "PathPrefix(`/sundial`)"
+        assert sundial_router["service"] == "sundial"
+        assert sundial_router["middlewares"] == [
+            "redirect-sundial-slash",
+            "strip-sundial",
+        ]
+        assert sundial_router["priority"] > out_routers_http["web-terminal"]["priority"]
+        assert out_routers_http["web-terminal"]["rule"] == "PathPrefix(`/`)"
+
 
 def _write_app_meta(app_name: str):
     app_path = get_installed_apps_path() / app_name